domains / families / security / hunt-fastapi

hunt-fastapi

separate

Hunt FastAPI-specific vulnerabilities: dependency injection gaps, Pydantic coercion, and OpenAPI mining.

When to use

• Target uses FastAPI (indicated by `/docs`, `/redoc`, `/openapi.json`, or `server: uvicorn`).
• OpenAPI schema is publicly accessible.
• API uses dependency injection (`Depends`) for authorization.
• WebSocket endpoints exist alongside REST API.
• Application uses Pydantic v1 or v2 for request validation.

Skill page

Source